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NRS AUDIT AND RISK COMMITTEE MEETING 
16 September 2021 
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MS Teams 
ARC Members 
Colin Ledlie (Chair) NRS Non-Executive Director 
Bill Matthews NRS Non-Executive Director 
Christine Martin NRS Non-Executive Director 
ARC Attendees 
Asif Haseeb External Auditor — Audit Scotland 
Graeme Samson External Auditor — Audit Scotland 
Dougie Shepherd Internal Auditor — Scottish Government 
Lorraine Twyford Internal Auditor - Scottish Government 
Paul Lowe NRS, Chief Executive 
Linda Sinclair NRS, Director of Corporate Services & Accountable officer 
Claire Gillespie NRS, Chief Financial Officer 
Matthew Sinclair NRS, Chief Technology Officer (Item 3) 
Lesley Smillie NRS Census Director team (Item 4) 
Shirley Cameron NRS, Business Management, Secretariat 
Observer 
Mandy Gallacher NRS Non-Executive Director (Item 4) 
1. Welcome, Introductions and Declaration of Interests 


1.1 The Chair welcomed everyone to the meeting. Mandy Gallacher, Non- 
Executive Director Member of the NRS Strategic Board attended for item 4. There 
were no new declarations of interest. 

2. Minutes and Actions 


2.1. The minutes of 8 June 2021 were accepted. The minutes would be published 
on the NRS Website Governance page. 


2.2 No open actions were reported. 

3. Deep Dive IT Disaster Recovery — Matthew Sinclair 

3.1 Matthew Sinclair provided the Committee with an overview of activity to 
improve IT disaster recovery capability in NRS. The update also provided an 
overview of the initial position as well as the steps taken to improve resilience and 


security. 


3.2 The Committee were interested to learn about contingency arrangements for 
shared services where NRS has a reliance and the steps in place to mitigate risks. 


4. Scotland’s Census 2022: Update Report — Lesley Smillie 


4.1 Lesley Smillie provided Committee members with an update on the 
programme status. The following items were covered in the report: 
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e Programme Directors Summary Report, which highlighted progress and 
achievements in the programme since the last report to Audit and Risk 
Committee. 

e Programme Strategic Risk Themes & Issues - it was noted that a review of 
strategic risks was underway. Specific risks highlighted included: 

o R001 - Right, Skilled People - capability or capacity - to successfully 
deliver the Census 

o R007 — Financial budget for year 2021/2022 . 

o R008 - Census solution go live risks. 

e An operational readiness assessment report was included for information 

e A report on the assurance activity for the programme included updates on 
activity undertaken to date and planned further activity : 

o Scottish Government Digital Assurance Office (DAO) reviews relating 
to the technical assurance framework (TAF). This included progress 
against the action plan from the Healthcheck review in July and 
planning for the delivery gate in November, 

o Scottish Government Digital First reviews on Census collect and on 
Census Outputs, 

o National Statistics Authority accreditation activity and 

o Independent Information Assurance Review. 


4.2 Colin Ledlie asked that the Committee have advanced sight of the output of 
the strategic risk review ahead of the next ARC meeting. 


Action : A01/21: Scotland’s Census Risk Review - To provide the Committee 
with the strategic risk revisions when approved and in advance of the next 
ARC on 9 December 2021. Owner: Lesley Smillie 


4.3 Mandy Gallacher asked for clarity around the TAF go/no go review planned 
for November and welcomed the positive update provided. Lesley Smillie reported 
that the technology aspects were in a strong position with action and focus to 
strengthen operational aspects underway. 


5. NRS Annual Report and Accounts 2020-2021 


NRS Annual Report and Accounts 2020-2021 and covering paper - Linda 
Sinclair/Claire Gillespie 


5.1 The Committee had been provided with a draft copy of the NRS Annual 
Report and Accounts (AR&A) for 2020-2021. 


5.2 Claire Gillespie invited the Committee to note the Chief Finance Officer 
statement which was recorded as ‘I can confirm that to the best of my knowledge 
there are no events after the reporting period that | need to make the committee 
aware of’. Additionally, the Committee were invited to approve the AR&A, that 
members were content that the AR&A provided a true reflection of NRS as at 31 
March 2021 and content that approval to sign the AR&A could be provided. 


5.3 The Committee reviewed the governance statement in the annual report 
noting the Substantial Assurance opinion from Internal Audit. 
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5.4 Ahead of approving the AR&A the Committee sought the opinion from 
External Auditors, Audit Scotland. 


External Audit — Annual Report 2020-2021 and ISA 260 covering letter - Asif Haseeb 
and Graeme Samson 





5.5 Asif Haseeb introduced the ISA 260 Covering Letter and Annual Audit Report 
to the Committee. The main findings and key messages of the report were drawn to 
the Committee’s attention by Graeme Samson including: 
e The audit opinions on the annual report and accounts were unmodified 
e The financial statements gave a true and fair view of the state of affairs of 
National Records of Scotland (NRS) as at 31 March 2021. 
e Ahighlight of the key messages and two recommendations were noted. 

o Recommendation one — ‘Management should continue to consider 
value for money when recruiting high-cost temporary staff’. 

o Recommendation two — ‘NRS will need to continue to closely monitor 
progress with the Census programme and act on recommendations 
from reviews in order to ensure delivery in line with the revised budget 
and timetable’. 


5.6 In discussion is was noted that NRS had been made aware of the Auditor 
General’s intention to prepare a Section 22 report, under the Public Finance and 
Accountability (Scotland) Act 2000. It was noted that the Section 22 report provided 
the Auditor General with the mechanism to prepare a report on matters arising from 
the audit of the accounts of a public body and bring these to the attention of the 
Scottish Parliament, Public Audit Committee. The discussion covered: 

e The reasons and purpose of the Section 22 report. Asif Haseeb noted it would 
be a short and factual report. He indicated that the Section 22 decision by the 
Auditor General was to put a marker down on the Census Programme. This 
would give the Auditor General the opportunity to come back after Census 
collect in Spring 2022 and do a further report at this stage if required, 
depending on success of delivery and spend. Asif also provided an overview 
of the mechanism and timescales, noting the report would be publicised. 

e Paul Lowe reflected that neither he, as CEO of NRS, nor Linda Sinclair as 
NRS Accountable Officer, had officially been advised of the Section 22 report. 
Information had been provided to NRS via the Scottish Government which 
created communication challenges for NRS. A request for Audit Scotland to 
learn lessons from the NRS experience was noted. 

e lt was noted that the process would likely have a significant time pressure on 
NRS at a critical point in the delivery of the Census programme, as it 
approached the ‘collect’ phase. It was also observed that the timing of the 
publication of the report and scrutiny of the programme had the potential to 
impact negatively on public confidence and census messaging, with the 
potential to impact response rates. 

e Asif Haseeb noted that the mechanism of communicating the Section 22 had 
not been ideal. He confirmed that NRS management would have the 
opportunity to view the draft report for accuracy before it was published. 

e Bill Matthews suggested that ARC could support providing constructive 
feedback to Audit Scotland noting it that it would feel very unfortunate if the 
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mechanism AS have put in place or its timing, could negatively impact the 
delivery or the realisation of the benefits the programme was expected to 
deliver. 


5.7 Following assurance that questions asked by the CFO had been answered, 
The Committee were content to recommend that the Accountable Officer approve 
and sign the NRS Annual Report and Accounts for 2020-2021 (AR&A). 


5.8 The NRS Accountable Officer and Audit Scotland would sign the AR&A which 
would be submitted to the Auditor General. In due course the AR&A would be laid in 
the Scottish Parliament. 


Draft Audit and Risk Committee Annual Report 2020-2021 to the NRS Chief 
Executive, Accountable Officer and Strategic Board — Colin Ledlie 


5.9 A draft of the Audit and Risk Committee annual report, first reviewed on 8 
June 2021 was presented to the Committee. Following discussion, it was agreed that 
a proposed final version of the report would be circulated to committee members in 
correspondence seeking approval of the report. Following approval the report would 
be published on the NRS website. 


5.10 The Committee had noted the “Substantial Assurance” opinion received from 
internal audit and the unmodified opinion of Audit Scotland following their audit 
report. 


6. NRS Finance Report 2021-2022 — Claire Gillespie 


6.1 Claire Gillespie presented the report which asked members to note the 
financial position at the end of period 4 of 2021-2022. 


6.2 A reported overspend on operating costs was being monitored closely. It was 
reported the NRS core expenditure to year end would be managed in line with 
budget. 


6.3 The position with Census Programme operating costs was noted as near to 
forecast for the year to date. The year-end position was noted as posing a financial 
risk in terms of a pressure in line with go live being at year end. Action to manage 
the risk was ongoing across the programme with a resource review and commercial 
deep dive underway. The fluidity of the programme, contract costs based on 
volumetrics, which would be subject to actual demand and the timing of go live at the 
end of the financial year being noted as limiting factors in mitigating the risk. 


6.4 it was advised that the capital position was reporting an underspend, with 
activity underway to identify initiatives, of which business cases would be subject to 
NRS governance approval routes. 


6.5 Opportunities for revenue savings were continuing to be evaluated across 
NRS with opportunities to cross fund pressures and prioritise activities being 
considered where possible. 
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7. Internal Audit Progress Report for Audit and Risk Committee — Lorraine Twyford 
and Dougie Shepherd 


7.1 Lorraine Twyford introduced the paper and indicated the 2021-2022 audit plan 
was being progressed and was reported to be on track to deliver. Additional 

capacity in the plan around quarter four 2021/2022 would be discussed with NRS 
management. 

7.2 For the first time, the report included input directly from the SG Digital 
Assurance Office (DAO). A suggestion to invite colleagues from that team to ARC at 
an appropriate point would be considered by Internal Audit. 


7.3 A report into the Health and Safety Governance review was expected to be 
issued to the Committee once it was finalised. 


7.4 Other papers presented were taken as read and noted by the Committee. 
8. Audit and Risk Committee Terms of Reference and Checklist Review 


8.1 |The Committee considered the Terms of reference and agreed minor 
amendments, they also agreed the business planned for the coming year. 


8.2 Colin Ledlie invited comments from the Committee on the self-assessment 
report. After a short discussion, the Committee noted the content of the report and 
provided approval. 

9. Committee Documents to Note and Questions 


NRS Governance Report 


9.1 Linda Sinclair introduced the paper, which provided a summary of activity 
across the NRS internal systems of control. Following a short discussion, the 
Committee noted the contents of the report. 


NRS Portfolio report 


9.2 |The Committee noted the report, which provided an update on the status of 
current NRS projects and programmes. 


NRS COVID-19 Report 


9.3 The Committee noted the report, which provided an update on the activity and 
planning underway in relation to the pandemic. 


NRS Assurance activities update 


9.4 The Committee noted the report, which provided an update on the status of 
activities since the last report presented to Audit and Risk Committee in June 2021. 


10. Forward Look Audit and Risk Committee 
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10.1 The report was included for information and outlined proposed ARC business 
for the next twelve months. A review of the forward plan activity had been 
undertaken by the ARC Chair and NRS Management during August 2021 which had 
been provided to ARC and to NRS Strategic Board for information. 

11. Any other Business 

11.1 No other business was noted 

12. Date of next meeting 


12.1 The next meeting was planned for 9 December 2021. 
END 


